CCSP Practice Test

Answer choices

1. A. Delete duplicates immediately without documenting the process, for the described technical objective and its associated operational control requirements, for consideration.
2. B. Move all records to a new provider before collection, as the primary implementation for the described business requirement.
3. C. Preserve relevant data and metadata under legal hold with traceable collection and chain-of-custody controls, as the primary proposed approach.
4. D. Disable audit logging to reduce discoverable information, for the required operational result and control objective.

Wrong-answer review

• A. Delete duplicates immediately without documenting the process, for the described technical objective and its associated operational control requirements, for consideration.: Not the best answer. This option does not most directly satisfy the scenario or the cited guidance; preserve relevant data and metadata under legal hold with traceable collection and chain-of-custody controls is the better-supported action.
• B. Move all records to a new provider before collection, as the primary implementation for the described business requirement.: Not the best answer. This option does not most directly satisfy the scenario or the cited guidance; preserve relevant data and metadata under legal hold with traceable collection and chain-of-custody controls is the better-supported action.
• D. Disable audit logging to reduce discoverable information, for the required operational result and control objective.: Not the best answer. This option does not most directly satisfy the scenario or the cited guidance; preserve relevant data and metadata under legal hold with traceable collection and chain-of-custody controls is the better-supported action.

Answer choices

1. A. Instrumenting the application to observe runtime behavior and measure control effectiveness, under the documented operational and governance requirements.
2. B. Monitoring network traffic for suspicious outbound connections, for the affected environment.
3. C. Implementing a web application firewall (WAF) to protect against common attacks, as the primary proposed approach.
4. D. Performing static code analysis to identify vulnerabilities before deployment, for the stated scenario.

Answer choices

1. A. Remove customer access before any export occurs, for the stated implementation and support requirements.
2. B. Leave deletion procedures unspecified, for the required operational result and control objective.
3. C. Allow the provider to retain all customer data indefinitely, within the documented operational, security, ownership, and validation requirements.
4. D. Define data return/export, retention, secure deletion, verification, and timing responsibilities, for the described technical objective.

Answer choices

1. A. Archive records for the defined retention period, suspend disposal when legally held, and securely delete them when retention obligations end, under the organization’s defined implementation and exception-management process.
2. B. Rely on application users to decide when each record is deleted, for the described technical objective and its associated operational control requirements, for the described technical objective.
3. C. Delete records after one year if storage costs increase, for the described technical objective and its associated operational control requirements.
4. D. Keep every record indefinitely, for the described technical objective and its associated operational control requirements, under the documented operational and governance requirements.

Answer choices

1. A. Servers have asset tags, for the described technical objective and its associated operational control requirements, for review.
2. B. Critical cooling has no redundant capacity or alternate path, for this task.
3. C. The site uses hot-aisle/cold-aisle containment, for the stated security, delivery, and accountability requirements.
4. D. The racks use standardized rail kits, for the affected environment.

Answer choices

1. A. Detailed forensic analysis of the compromised systems to identify the specific vulnerabilities exploited, within the proposed design.
2. B. Active participation of numerous internal and external parties with diverse roles and responsibilities across various locations, within the proposed design.
3. C. Strict adherence to a predefined incident response plan developed solely by internal incident handlers, within the stated policy framework.
4. D. Immediate isolation of all affected systems and a complete shutdown of the cloud environment, under the organization’s defined implementation and exception-management process.

Answer choices

1. A. Cloud auditor, as presented.
2. B. Cloud carrier, within the stated policy framework.
3. C. Cloud consumer, for the required outcome.
4. D. Cloud service broker, as described.

Answer choices

1. A. Credential issuer only, as presented.
2. B. Relying party, for evaluation.
3. C. Identity provider, under the documented operational and governance requirements.
4. D. Cloud carrier, for the required business outcome.

Answer choices

1. A. Clarify the shared-responsibility assignment and implement ownership for the control, under the stated decision criteria.
2. B. Change providers without investigating responsibility, for the described technical objective and its associated operational control requirements.
3. C. Treat the gap as accepted automatically, for the specified implementation requirement.
4. D. Remove the control from the baseline, for the required operational result and control objective.

Answer choices

1. A. Publish the dataset to improve reproducibility, as the primary implementation for the described business requirement.
2. B. Validate dataset provenance, remove or protect sensitive data, and restrict access to authorized training processes, within the proposed design.
3. C. Disable data-quality checks because they can change model behavior, within the documented scope, ownership, and validation boundaries.
4. D. Give all developers full dataset access for convenience, within the documented scope, ownership, and validation boundaries.